WP020——CTF赛题解析-脚本

时效性

2025年8月8日

题目来源

秋名山车神 - Bugku CTF平台

题目描述

Write UP

1、直接使用脚本进行计算和提交，在两秒钟内进行数值提交即可

python 复制代码

import requests
import re
from bs4 import BeautifulSoup
import time

def calculate_expression(expression):
    """安全计算数学表达式"""
    # 清理表达式：移除非数学字符
    cleaned = re.sub(r'[^\d+\-*]', '', expression)
    # 分割数字和运算符
    parts = re.split(r'([+\-*])', cleaned)
    # 过滤空字符串
    parts = [p for p in parts if p]
    
    # 先处理所有乘法
    i = 0
    while i < len(parts):
        if parts[i] == '*':
            left = int(parts[i-1])
            right = int(parts[i+1])
            result = left * right
            parts = parts[:i-1] + [str(result)] + parts[i+2:]
            i -= 1
        else:
            i += 1
    
    # 再处理加减法
    result = int(parts[0])
    for i in range(1, len(parts), 2):
        operator = parts[i]
        num = int(parts[i+1])
        if operator == '+':
            result += num
        elif operator == '-':
            result -= num
    
    return result

def main(url):
    for attempt in range(3):  # 最多尝试3次
        try:
            session = requests.Session()
            
            # 步骤1: 获取页面
            get_response = session.get(url)
            if get_response.status_code != 200:
                print(f"获取页面失败，状态码: {get_response.status_code}")
                continue
                
            # 步骤2: 解析表达式
            soup = BeautifulSoup(get_response.text, 'html.parser')
            div_content = soup.find('div').text.strip()
            expression = div_content.split('=')[0].replace('?', '').strip()
            
            # 步骤3: 计算表达式
            start_time = time.time()
            result = calculate_expression(expression)
            calc_time = time.time() - start_time
            
            # 步骤4: 发送POST请求
            post_data = {'value': str(result)}
            post_response = session.post(url, data=post_data)
            
            # 输出结果
            print(f"尝试 #{attempt + 1}")
            print(f"表达式: {expression}")
            print(f"计算结果: {result}")
            print(f"计算耗时: {calc_time:.4f}秒")
            print("\nPOST响应内容:")
            print(post_response.text)
            print("\n" + "="*50 + "\n")
            
            # 检查是否成功
            if "flag" in post_response.text.lower() or "success" in post_response.text.lower():
                print("成功提交答案!")
                return
                
        except Exception as e:
            print(f"尝试 #{attempt + 1} 出错: {str(e)}")
            time.sleep(0.5)  # 短暂等待后重试

if __name__ == "__main__":
    target_url = "http://117.72.52.127:18350/"  # 替换为实际URL
    main(target_url)

2、按照网上的说法，可以对Cookie生命周期进行修改然后进行计算，不过我没有进行尝试